Powerprotect Data Domain Appliances CVE-2026-35154

Exploitation requires: (1) local access to iDRAC-either physical console access to the appliance or network access to iDRAC management interface from internal networks; (2) pre-existing high-privilege credentials (administrative or equivalent iDRAC account); (3) user interaction to perform the exploit sequence (attack cannot be fully automated); (4) high complexity in execution, suggesting the attacker must understand the specific iDRAC configuration and interface flow required. Default iDRAC configurations are vulnerable; no special non-default configuration is required. Exploitation is NOT possible by unauthenticated remote attackers or low-privilege users.

CVSS 6.3 with vector AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H indicates moderate severity, but multiple factors limit real-world exploitation risk. The local attack vector (AV:L) means the attacker must have physical or logical access to the appliance-not remote exploitation. High privileges (PR:H) required; the attacker must already possess administrative or equivalent access. User interaction (UI:R) is required, indicating the attack cannot be fully automated. High complexity (AC:H) suggests non-trivial exploitation steps. Collectively, these constraints mean the vulnerability is primarily a concern for insider threats, malicious administrators, or attackers with prior system compromise. The impact is confined to integrity and availability on the affected system (S:U). This is not a remote privilege escalation affecting enterprise environments broadly-it is a control on already-privileged users within data protection infrastructure.

A disgruntled system administrator with existing iDRAC access crafts a specific sequence of iDRAC interface actions that triggers the improper privilege management flaw, allowing them to escalate their privileges and execute unauthorized delete operations on protected data or system configurations without audit override controls.